Use k3s as a default service-alias and set tls-san

Sometimes the server comes up without a valid certificate. See #5 (closed)

After trial and error, I determined that the most robust solution was to provide the --tls-san server argument. To simplify the setup, I've changed the default setup to assume k3s as the service alias, and updated the documentation on how to properly override it.

Note: I only validated this empirically by running numerous pipelines on this image. The idea being that if all of them succeed, then it is unlikely the bug is still present. But it is possible that I was just unlucky.